ripsecrets

The tool uses two primary methods to identify secrets:

1. Known Patterns: Uses regular expressions to match API keys with predefined prefixes (e.g., Stripe, Slack).
2. Randomness Detection: For secrets without a known pattern (like AWS secret access keys), ripsecrets looks for variables or properties assigned words like token, secret, or password. It then calculates the probability that the assigned string occurred by random chance. If the probability is less than 1 in 10,000, it is flagged as a secret.

ripsecrets operates entirely locally and never sends data to third-party services for verification.

If you use the pre-commit framework, add ripsecrets to your .pre-commit-config.yaml. There are two hook types available:

1. ripsecrets (Recommended): Automatically sets up a Rust environment to compile and run the tool.
2. ripsecrets-system: Looks for a ripsecrets binary already present on your PATH. This requires manual installation via Homebrew, Cargo, or pre-built binaries.

Example Configuration

repos:
  - repo: https://github.com/sirwart/ripsecrets
    rev: v0.1.8 # Use latest tag on GitHub
    hooks:
      - id: ripsecrets
        # args:
        # - --additional-pattern 'mytoken*'
        # - --additional-pattern 'mykey*'

To prevent secrets from being committed to your Git repository, you can integrate ripsecrets into your workflow.

Automatic Installation

Run this command to automatically configure a pre-commit hook in your current repository:

ripsecrets --install-pre-commit

Manual Installation

If you are managing your own pre-commit scripts, add the following command. Using --strict-ignore ensures that your .secretsignore file is respected:

ripsecrets --strict-ignore `git diff --cached --name-only --diff-filter=ACM`

You can install ripsecrets using several different methods depending on your environment:

Homebrew (macOS and Linux)

brew install ripsecrets

Cargo (Rust/Cargo users)

cargo install --git https://github.com/sirwart/ripsecrets --branch main

Nix Flake

nix profile install github:sirwart/ripsecrets

Pre-built Binaries

Download the latest binary directly from the GitHub releases page.

By default, running ripsecrets recursively searches source files in your current directory for secrets. For every secret found, it prints the file, line number, and the secret itself. If secrets are found, the process exits with a non-zero status code.

Basic Usage

ripsecrets

Scanning specific files or directories

You can pass specific paths as arguments:

ripsecrets file1 file2 dir1

Finding custom secrets with regex

Use the --additional-pattern flag to detect custom secret formats. Any capturing groups in your regex will be tested for randomness. To avoid randomness testing on a pattern, use non-capturing groups (e.g., (?:foo|bar) instead of (foo|bar)).

ripsecrets --additional-pattern 'my-secret-\*' 

The library includes a set of built-in regex patterns to detect common secrets. These include:

• URLs/Credentials: Generic URL patterns with embedded credentials.
• Tokens: JWT/JWE, GitHub (personal access tokens), GitLab, Stripe, Square, Azure Storage, GCP API Keys, npm (modern and legacy), Slack, and Slack Webhooks.
• Private Keys: RSA, EC, DSA, OpenSSH, PGP, and AGE secret keys.
• Other: Twilio, Mailchimp, and Intra42 patterns.
• Random Strings: Uses matcher::RANDOM_STRING_REGEX for high-entropy string detection.

ripsecrets provides two ways to prevent specific strings from being flagged as secrets:

1. .secretsignore file: You can provide a set of specific byte sequences (secrets) to the IgnoringMatcher that should be skipped during scanning.
2. Inline Pragma: You can suppress a secret detection on a specific line by adding a pragma comment. The matcher looks for the pattern pragma: allowlist secret on the same line to skip the match.

ripsecrets uses a specific regex pattern to identify potential secrets. It looks for lines containing keywords like key, token, secret, or password (case-insensitive) followed by assignment operators (e.g., :, =, :=, =>, <-, >) and a high-entropy string between 15 and 90 characters long.

To reduce false positives, the tool applies a randomness check (is_random) on the captured string. A string is only flagged if it passes a statistical randomness threshold (based on the p_random algorithm). If the string contains no numbers, the threshold for randomness is stricter.

// The regex used for identifying secret patterns:
// (?i:key|token|secret|password)\w*["' ]?]?\s*(?:[:=]|:=|=>|<-|>)\s*[\t "'`]?([\w+./=~\-\\\^]{15,90})(?:[\t\n "'`]|</|$)

You can exclude specific files, directories, or individual secrets from being scanned.

Using .secretsignore

Create a .secretsignore file in your repository. It supports syntax similar to .gitignore. You can also use a [secrets] section to ignore specific string values.

# Ignore files/directories
test/*
dummy

# Ignore specific secret strings
[secrets]
pAznMW3DsrnVJ5TDWwBVCA

Using allowlist comments

ripsecrets is compatible with detect-secrets style allowlist comments. Add the comment # pragma: allowlist secret to the same line as the detected secret:

test_secret = "pAznMW3DsrnVJ5TDWwBVCA" # pragma: allowlist secret